Add several Sonar hotspot mappings

.github/workflows/checks.yml

@@ -64,7 +64,7 @@ jobs:
           python-version: '3.11'
 
       - name: Install Semgrep
-        run: python3 -m pip install semgrep
+        run: python3 -m pip install semgrep==1.84.1
 
       - name: Run Check task
         uses: gradle/gradle-build-action@842c587ad8aa4c68eeba24c396e15af4c2e9f30a # v2.9.0

.github/workflows/release.yml

@@ -28,7 +28,7 @@ jobs:
           python-version: '3.11'
 
       - name: Install Semgrep
-        run: python3 -m pip install semgrep
+        run: python3 -m pip install semgrep==1.84.1
 
       - uses: actions/setup-java@v3
         with:

README.md

@@ -27,7 +27,7 @@ Follow these instructions if you intend to modify and build this project from so
    [here](https://semgrep.dev/docs/getting-started/#installing-and-running-semgrep-locally)
    for instructions. It can usually be done via `pip`:
    ```shell
-   pip install semgrep
+   pip install semgrep==1.84.1
    ```
 
 If your python library paths contain your home directory as a root folder (i.e.

core-codemods/src/intTest/java/io/codemodder/integration/GitRepositoryTest.java

@@ -97,7 +97,12 @@ protected void verifyNoFailedFiles(final CodeTFReport report) {
             .map(CodeTFResult::getFailedFiles)
             .flatMap(Collection::stream)
             .toList();
-    assertThat(failedFiles.size(), is(0));
+    if (!failedFiles.isEmpty()) {
+      System.out.println("Failed files during scan:");
+      failedFiles.forEach(System.err::println);
+    }
+    int size = failedFiles.size();
+    assertThat(size, is(0));
   }
 
   protected void verifyStandardCodemodResults(final List<CodeTFChangesetEntry> fileChanges) {

core-codemods/src/main/java/io/codemodder/codemods/DefaultCodemods.java

@@ -12,6 +12,7 @@
 import io.codemodder.codemods.semgrep.SemgrepServletResponseWriterXSSCodemod;
 import io.codemodder.codemods.semgrep.SemgrepWeakRandomCodemod;
 import io.codemodder.codemods.semgrep.SemgrepXXECodemod;
+import io.codemodder.codemods.sonar.*;
 import java.util.List;
 
 /**
@@ -89,12 +90,15 @@ public static List<Class<? extends CodeChanger>> asList() {
         SemgrepOverlyPermissiveFilePermissionsCodemod.class,
         SimplifyRestControllerAnnotationsCodemod.class,
         SubstituteReplaceAllCodemod.class,
+        SonarCookieMissingSecureFlagCodemod.class,
         SonarJNDIInjectionCodemod.class,
         SonarObjectDeserializationCodemod.class,
         SonarRemoveUnthrowableExceptionCodemod.class,
         SonarSQLInjectionCodemod.class,
         SonarSSRFCodemod.class,
         SonarUnsafeReflectionRemediationCodemod.class,
+        SonarWeakHashingAlgorithmCodemod.class,
+        SonarWeakRandomCodemod.class,
         SonarXXECodemod.class,
         SQLParameterizerCodemod.class,
         SSRFCodemod.class,

core-codemods/src/main/java/io/codemodder/codemods/AddMissingOverrideCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/AddMissingOverrideCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.body.MethodDeclaration;

core-codemods/src/main/java/io/codemodder/codemods/AvoidImplicitPublicConstructorCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/AvoidImplicitPublicConstructorCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Modifier;

core-codemods/src/main/java/io/codemodder/codemods/ConstantNameStringGenerator.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/ConstantNameStringGenerator.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import java.util.Set;
 import java.util.regex.Matcher;

core-codemods/src/main/java/io/codemodder/codemods/CreateConstantForLiteral.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/CreateConstantForLiteral.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Modifier;

core-codemods/src/main/java/io/codemodder/codemods/DeclareVariableOnSeparateLine.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/DeclareVariableOnSeparateLine.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.Node;
 import com.github.javaparser.ast.NodeList;

core-codemods/src/main/java/io/codemodder/codemods/DeclareVariableOnSeparateLineCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/DeclareVariableOnSeparateLineCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Node;

core-codemods/src/main/java/io/codemodder/codemods/DeclareVariableOnSeparateLineForFieldDeclaration.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/DeclareVariableOnSeparateLineForFieldDeclaration.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.Node;
 import com.github.javaparser.ast.NodeList;

core-codemods/src/main/java/io/codemodder/codemods/DeclareVariableOnSeparateLineForVariableDeclarationExpr.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/DeclareVariableOnSeparateLineForVariableDeclarationExpr.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.Node;
 import com.github.javaparser.ast.NodeList;

core-codemods/src/main/java/io/codemodder/codemods/DefineConstantForLiteral.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/DefineConstantForLiteral.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.Range;
 import com.github.javaparser.ast.CompilationUnit;

core-codemods/src/main/java/io/codemodder/codemods/DefineConstantForLiteralCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/DefineConstantForLiteralCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.expr.StringLiteralExpr;

core-codemods/src/main/java/io/codemodder/codemods/FixRedundantStaticOnEnumCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/FixRedundantStaticOnEnumCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.body.EnumDeclaration;

core-codemods/src/main/java/io/codemodder/codemods/HardenStringParseToPrimitivesCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/HardenStringParseToPrimitivesCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Node;

core-codemods/src/main/java/io/codemodder/codemods/OverridesMatchParentSynchronizationCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/OverridesMatchParentSynchronizationCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Node;

core-codemods/src/main/java/io/codemodder/codemods/RemoveCommentedCodeCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/RemoveCommentedCodeCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.comments.Comment;

core-codemods/src/main/java/io/codemodder/codemods/RemoveRedundantVariableCreationCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/RemoveRedundantVariableCreationCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.expr.*;

core-codemods/src/main/java/io/codemodder/codemods/RemoveUnusedImportCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/RemoveUnusedImportCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.ImportDeclaration;

core-codemods/src/main/java/io/codemodder/codemods/RemoveUnusedLocalVariableCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/RemoveUnusedLocalVariableCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Node;

core-codemods/src/main/java/io/codemodder/codemods/RemoveUnusedPrivateMethodCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/RemoveUnusedPrivateMethodCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Node;

core-codemods/src/main/java/io/codemodder/codemods/RemoveUselessParenthesesCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/RemoveUselessParenthesesCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.expr.EnclosedExpr;

core-codemods/src/main/java/io/codemodder/codemods/ReplaceStreamCollectorsToListCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/ReplaceStreamCollectorsToListCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.Node;

core-codemods/src/main/java/io/codemodder/codemods/SimplifyRestControllerAnnotationsCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/SimplifyRestControllerAnnotationsCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import static io.codemodder.ast.ASTTransforms.addImportIfMissing;
 import static io.codemodder.ast.ASTTransforms.removeImportIfUnused;

core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarCookieMissingSecureFlagCodemod.java

@@ -0,0 +1,62 @@
+package io.codemodder.codemods.sonar;
+
+import com.github.javaparser.ast.CompilationUnit;
+import io.codemodder.*;
+import io.codemodder.codetf.DetectorRule;
+import io.codemodder.providers.sonar.ProvidedSonarScan;
+import io.codemodder.providers.sonar.RuleHotspot;
+import io.codemodder.providers.sonar.SonarRemediatingJavaParserChanger;
+import io.codemodder.remediation.GenericRemediationMetadata;
+import io.codemodder.remediation.Remediator;
+import io.codemodder.remediation.missingsecureflag.MissingSecureFlagRemediator;
+import io.codemodder.sonar.model.Hotspot;
+import io.codemodder.sonar.model.SonarFinding;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import javax.inject.Inject;
+
+@Codemod(
+    id = "sonar:java/cookie-missing-secure-flag-2092",
+    reviewGuidance = ReviewGuidance.MERGE_AFTER_CURSORY_REVIEW,
+    importance = Importance.HIGH,
+    executionPriority = CodemodExecutionPriority.HIGH)
+public final class SonarCookieMissingSecureFlagCodemod extends SonarRemediatingJavaParserChanger {
+
+  private final Remediator<Hotspot> remediationStrategy;
+  private final RuleHotspot issues;
+
+  @Inject
+  public SonarCookieMissingSecureFlagCodemod(
+      @ProvidedSonarScan(ruleId = "java:S2092") final RuleHotspot hotspots) {
+    super(GenericRemediationMetadata.MISSING_SECURE_FLAG.reporter(), hotspots);
+    this.issues = Objects.requireNonNull(hotspots);
+    this.remediationStrategy = new MissingSecureFlagRemediator<>();
+  }
+
+  @Override
+  public DetectorRule detectorRule() {
+    return new DetectorRule(
+        "java:S2092",
+        "Make sure creating this cookie without the \"secure\" flag is safe here.",
+        "https://rules.sonarsource.com/java/type/Security%20Hotspot/RSPEC-2092/");
+  }
+
+  @Override
+  public CodemodFileScanningResult visit(
+      final CodemodInvocationContext context, final CompilationUnit cu) {
+    List<Hotspot> issuesForFile = issues.getResultsByPath(context.path());
+    return remediationStrategy.remediateAll(
+        cu,
+        context.path().toString(),
+        detectorRule(),
+        issuesForFile,
+        SonarFinding::getKey,
+        i -> i.getTextRange() != null ? i.getTextRange().getStartLine() : i.getLine(),
+        i ->
+            i.getTextRange() != null
+                ? Optional.of(i.getTextRange().getEndLine())
+                : Optional.empty(),
+        i -> Optional.empty());
+  }
+}

core-codemods/src/main/java/io/codemodder/codemods/SonarJNDIInjectionCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarJNDIInjectionCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import io.codemodder.*;

core-codemods/src/main/java/io/codemodder/codemods/SonarObjectDeserializationCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarObjectDeserializationCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import io.codemodder.*;

core-codemods/src/main/java/io/codemodder/codemods/SonarRemoveUnthrowableExceptionCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarRemoveUnthrowableExceptionCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.type.ClassOrInterfaceType;

core-codemods/src/main/java/io/codemodder/codemods/SonarSQLInjectionCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarSQLInjectionCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import com.github.javaparser.ast.expr.Expression;

core-codemods/src/main/java/io/codemodder/codemods/SonarSSRFCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarSSRFCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import io.codemodder.*;

core-codemods/src/main/java/io/codemodder/codemods/SonarUnsafeReflectionRemediationCodemod.java → core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarUnsafeReflectionRemediationCodemod.java

@@ -1,4 +1,4 @@
-package io.codemodder.codemods;
+package io.codemodder.codemods.sonar;
 
 import com.github.javaparser.ast.CompilationUnit;
 import io.codemodder.*;

core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarWeakHashingAlgorithmCodemod.java

@@ -0,0 +1,62 @@
+package io.codemodder.codemods.sonar;
+
+import com.github.javaparser.ast.CompilationUnit;
+import io.codemodder.*;
+import io.codemodder.codetf.DetectorRule;
+import io.codemodder.providers.sonar.ProvidedSonarScan;
+import io.codemodder.providers.sonar.RuleHotspot;
+import io.codemodder.providers.sonar.SonarRemediatingJavaParserChanger;
+import io.codemodder.remediation.GenericRemediationMetadata;
+import io.codemodder.remediation.Remediator;
+import io.codemodder.remediation.weakcrypto.WeakCryptoAlgorithmRemediator;
+import io.codemodder.sonar.model.Hotspot;
+import io.codemodder.sonar.model.SonarFinding;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import javax.inject.Inject;
+
+@Codemod(
+    id = "sonar:java/weak-hash-4790",
+    reviewGuidance = ReviewGuidance.MERGE_AFTER_CURSORY_REVIEW,
+    importance = Importance.HIGH,
+    executionPriority = CodemodExecutionPriority.HIGH)
+public final class SonarWeakHashingAlgorithmCodemod extends SonarRemediatingJavaParserChanger {
+
+  private final Remediator<Hotspot> remediationStrategy;
+  private final RuleHotspot issues;
+
+  @Inject
+  public SonarWeakHashingAlgorithmCodemod(
+      @ProvidedSonarScan(ruleId = "java:S4790") final RuleHotspot hotspots) {
+    super(GenericRemediationMetadata.WEAK_CRYPTO_ALGORITHM.reporter(), hotspots);
+    this.issues = Objects.requireNonNull(hotspots);
+    this.remediationStrategy = new WeakCryptoAlgorithmRemediator<>();
+  }
+
+  @Override
+  public DetectorRule detectorRule() {
+    return new DetectorRule(
+        "java:S4790",
+        "Using weak hashing algorithms is security-sensitive",
+        "https://rules.sonarsource.com/java/type/Security%20Hotspot/RSPEC-4790/");
+  }
+
+  @Override
+  public CodemodFileScanningResult visit(
+      final CodemodInvocationContext context, final CompilationUnit cu) {
+    List<Hotspot> issuesForFile = issues.getResultsByPath(context.path());
+    return remediationStrategy.remediateAll(
+        cu,
+        context.path().toString(),
+        detectorRule(),
+        issuesForFile,
+        SonarFinding::getKey,
+        i -> i.getTextRange() != null ? i.getTextRange().getStartLine() : i.getLine(),
+        i ->
+            i.getTextRange() != null
+                ? Optional.of(i.getTextRange().getEndLine())
+                : Optional.empty(),
+        i -> Optional.empty());
+  }
+}